CVE-2021-22054 - Vulnerability Details - OpenCVE

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Vmware	Workspace One Uem Console

Configuration 1 [-]

OR	cpe:2.3:a:vmware:workspace_one_uem_console::::::::
	cpe:2.3:a:vmware:workspace_one_uem_console::::::::
	cpe:2.3:a:vmware:workspace_one_uem_console::::::::
	cpe:2.3:a:vmware:workspace_one_uem_console::::::::

No data.

References

Link	Providers
https://www.vmware.com/security/advisories/VMSA-2021-0029.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2021-12-17T16:10:18

Updated: 2024-08-03T18:30:23.947Z

Reserved: 2021-01-04T00:00:00

Link: CVE-2021-22054

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-12-17T17:15:12.590

Modified: 2024-11-21T05:49:30.550

Link: CVE-2021-22054

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "VMware Workspace ONE UEM console", "vendor": "n/a", "versions": [{"status": "affected", "version": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37."}]}], "descriptions": [{"lang": "en", "value": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information."}], "problemTypes": [{"descriptions": [{"description": "VMware Workspace ONE UEM console patches SSRF vulnerability", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-12-17T16:10:18", "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.vmware.com/security/advisories/VMSA-2021-0029.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@vmware.com", "ID": "CVE-2021-22054", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "VMware Workspace ONE UEM console", "version": {"version_data": [{"version_value": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37."}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "VMware Workspace ONE UEM console patches SSRF vulnerability"}]}]}, "references": {"reference_data": [{"name": "https://www.vmware.com/security/advisories/VMSA-2021-0029.html", "refsource": "MISC", "url": "https://www.vmware.com/security/advisories/VMSA-2021-0029.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:30:23.947Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.vmware.com/security/advisories/VMSA-2021-0029.html"}]}]}, "cveMetadata": {"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "assignerShortName": "vmware", "cveId": "CVE-2021-22054", "datePublished": "2021-12-17T16:10:18", "dateReserved": "2021-01-04T00:00:00", "dateUpdated": "2024-08-03T18:30:23.947Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:workspace_one_uem_console:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3AAC724-403A-44F5-9D63-DDDF96896E99", "versionEndExcluding": "20.0.8.36", "versionStartIncluding": "20.0.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:workspace_one_uem_console:*:*:*:*:*:*:*:*", "matchCriteriaId": "7E572CA1-63EF-47F6-875F-EA323322A5DC", "versionEndExcluding": "20.11.0.40", "versionStartIncluding": "20.11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:workspace_one_uem_console:*:*:*:*:*:*:*:*", "matchCriteriaId": "9D85DEA2-2846-4222-81A6-75F4F09FB068", "versionEndExcluding": "21.2.0.27", "versionStartIncluding": "21.2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:workspace_one_uem_console:*:*:*:*:*:*:*:*", "matchCriteriaId": "8440AE91-8959-4558-899E-CBD1BD5F073F", "versionEndExcluding": "21.5.0.37", "versionStartIncluding": "21.5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information."}, {"lang": "es", "value": "La consola VMware Workspace ONE UEM versiones 20.0.8 anteriores a 20.0.8.37, versiones 20.11.0 anteriores a 20.11.0.40, versiones 21.2.0 anteriores a 21.2.0.27 y versiones 21.5.0 anteriores a 21.5.0.37, contienen una vulnerabilidad de tipo SSRF. Este problema puede permitir a un actor malicioso con acceso a la red de UEM enviar sus peticiones sin autenticaci\u00f3n y conseguir acceso a informaci\u00f3n confidencial"}], "id": "CVE-2021-22054", "lastModified": "2024-11-21T05:49:30.550", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-12-17T17:15:12.590", "references": [{"source": "security@vmware.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.vmware.com/security/advisories/VMSA-2021-0029.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.vmware.com/security/advisories/VMSA-2021-0029.html"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "nvd@nist.gov", "type": "Primary"}]}